Repository navigation
docs(bindings): correct the KV write ceiling and the lens rate limits - #371
Merged
Merged
Conversation
Three numbers in the bindings section disagreed with the platform and with this repo's own config. All three were checked against a source rather than recalled. RN_KV said "~10K writes/day budget". Workers KV allows 1,000 writes/day to distinct keys on Workers Free and is unlimited on Paid, so the figure was 10x optimistic on one plan and meaningless on the other. It matters because of the episode the same paragraph records: the /lens rate-limit counters were a write per allowed request on the busiest route here, which the note says "had quietly made 'we use a handful' false". Against 1,000 that was ten times closer to the ceiling than the file implied. The plan is now named as the fork rather than assumed, because nothing in this repo records which one the account is on. LENS_RL_* said "the four per-IP crawl budgets ... inspect 30/min, shot 8/min, compare 4/min, browser 4/min". wrangler.jsonc declares seven bindings and LENS_BUDGETS in lens.js declares six per-IP budgets plus the shared ceiling, with shot at 3 and browser at 3. Config and code have agreed with each other the whole time, because a contract test pins them together. The prose is a THIRD copy that test does not cover, and it is now labelled as one. The correction deliberately does not restate the old values. A stale number written as `N/min` inside its own correction is still a greppable stale number, which is the same failure one level down. DEPENDENCIES.md recorded Wrangler 4.112.0 and Oxc Minify 0.140.0 against pins of 4.120.0 and 0.144.0. Both now match package.json, along with the esbuild and Oxlint lines that were already correct. Verified: the six budgets, the shared ceiling and the binding count now agree across wrangler.jsonc, lens.js and CLAUDE.md, and every version claim in DEPENDENCIES.md matches package.json.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
aadhar-sh | dee42f5 | Aug 14 2026, 04:32 PM |
oddharsh
enabled auto-merge (squash)
August 14, 2026 16:35
This was referenced Aug 14, 2026
oddharsh
added a commit
that referenced
this pull request
Aug 14, 2026
docs/DEPENDENCIES.md states version pins in prose and dependabot rewrites those pins on a daily schedule, so the file goes stale on a cadence rather than by accident. It did so twice in two days: #371 corrected Wrangler 4.112.0 -> 4.120.0 and merged, then #377 bumped the pin to 4.120.1 hours later. Both times a human found it. This is the same class as gotcha 29's "one version pin in two files", and check-tools.mjs #375 is the precedent for the answer. The check adds NO third copy. tools.json had to declare what no manifest recorded; every number here is already in package.json or requirements.txt, so this reads those as the source of truth and holds the prose to them. Two directions, because either alone is decoration. Forward: every version the doc states for a known package must match its pin. Reverse: every root dependency must be documented or exempted by name with a reason, so adding a dependency forces a documentation decision instead of landing unmentioned. IT FOUND TWO THINGS ON ITS FIRST RUN, and the second is the one worth having. Wrangler was the expected drift. @noble/post-quantum was not documented at all, and it is the ONLY dependency in this repo that reaches a visitor: workerd ships no post-quantum algorithm in WebCrypto, so AadharshBot's ML-DSA-44 sig2 is pure JavaScript in the Worker bundle. It is now documented as such, with the note that its releases want reading for bundle size as well as correctness, because it is Worker bytes rather than build bytes. The scanner is deliberately not a general "Name 1.2.3" sweep. That would be the fourth naive scanner this repo has caught, and DEPENDENCIES.md breaks it three ways in its own text: `CSS Overflow 5`, `Vite 8`, and `TypeScript 7.0` (two components, discussing the major line rather than the pin) all read as version claims. It matches a known alias followed by a full three-component version, and a test asserts those four real sentences yield zero claims. auditDependencyDocs is pure and takes its policy as parameters, so the negative cases run against two-line fixtures rather than needing the whole manifest reconstructed to keep the other rules quiet. Same reasoning as lib/cron.js. Six negative cases assert the check has teeth, including the floor, because a version of this that only ever agreed with the current tree would be the third check here to pass while asserting nothing. Verified: 274/274 contract tests, lint 0, typecheck 0, build 0, pages:check 0. oxlint flagged a useless spread fallback in the first draft, which is the linter that landed this morning earning its place on the same day. Co-authored-by: Aadharsh Pannirselvam <19518661+oddharsh@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three numbers in the
Cloudflare bindingssection of CLAUDE.md disagreed with the platform or with this repo's own config, plus two stale version claims indocs/DEPENDENCIES.md. Everything here was checked against a source rather than recalled.RN_KV:
~10K writes/daywas wrong on both plansWorkers KV allows 1,000 writes/day to distinct keys on Workers Free and is unlimited on Paid, with a 1 write/sec same-key limit on either. The stated figure was 10x optimistic on one plan and meaningless on the other.
It matters because of the episode the same paragraph already records: the
/lensrate-limit counters were a KV write per allowed request on the busiest route here, which "had quietly made 'we use a handful' false." Against 1,000 rather than 10,000, that was ten times closer to the ceiling than the file implied.The plan is now named as the fork rather than assumed. Nothing in this repo records which plan the account is on, which is worth fixing separately since every Browser Run ceiling forks the same way.
LENS_RL_*: four budgets declared, seven exist
Config and code agreed with each other throughout, because a contract test pins them together. The prose is a third copy that test does not cover, and it is now labelled as one so the next reader knows it carries no guard.
The correction deliberately does not restate the old values. A stale number written as
N/mininside its own correction is still a greppable stale number, which is the same failure one level down. (Caught by my own verification script reading the historical quote instead of the corrected list.)DEPENDENCIES.md
Wrangler
4.112.0→4.120.0and Oxc Minify0.140.0→0.144.0, matching the pins. The esbuild and Oxlint lines were already correct after #367.Verification
Not asserted, run:
wrangler.jsonc,www/_worker.js/lens.jsandCLAUDE.mdDEPENDENCIES.mdmatchespackage.json(Wrangler, Oxc Minify, esbuild, Oxlint)12.3.0re-checked against PyPI and is currentProse only. No code, config or served byte changes.
Note for whoever holds the dirty tree
The main checkout has uncommitted edits to
docs/DEPENDENCIES.md(the same two version lines) and topnpm-workspace.yaml(thesharpallowBuilds placeholder). This branch was taken offorigin/mainso it does not touch that work. Thesharpfix is not in here and still wants committing.